Field-level PII encryption
ID numbers, income and banking fields are AES-256-GCM encrypted at rest, with searchable blind indexes where needed. Decrypt-at-fetch keeps application code readable without leaving plaintext in derived stores.
Security & compliance
Controls you can diligence — not certification theatre
Multi-tenant isolation, field-level PII encryption, audit trails, POPIA workflows and controls mapped to common frameworks — built for finance providers.
We map controls to common frameworks. We do not claim formal ISO or SOC certification on this site.
Multi-tenant isolation
Every query and mutation is tenant-scoped in application code, with optional Postgres RLS. Dealer seats only see their own deals. Platform roles cannot fall through into dealer-only routes.
Audit & decision trails
Sensitive actions capture actor, context and before/after. Automated credit decisions are reason-coded and version-pinned for POPIA §71 human-review readiness.
POPIA operations
Data-subject-request queue with a 30-day clock, consent ledger, right-to-erasure paths, breach register and retention sweeps for tokens and drafts.
Hardened platform defaults
TLS in transit, HSTS, CSP, signature-verified webhooks, SSRF defences, parameterised queries and PII-scrubbed error reporting. Framework controls are mapped — we do not claim formal ISO or SOC certification.
Your credentials, your rails
Integration secrets are encrypted per tenant. DebiCheck, bureau and telematics relationships stay yours; settlement goes to your bank account.
Further reading